So let me bounce that question back: what's keeping those security OS developers from already porting their work to the N900 ?

Lack of awareness of its existence maybe? It's a good question. Perhaps we should be engaging more with these security-focused OS communities to find out why. The Neo900 has a potential audience there.

So let me bounce that question back: what's keeping those security OS developers from already porting their work to the N900 ?

I'm not an OS developer, so I can only make assumptions.
Generally speaking about phones :
1) Maybe too time-consuming compared to the lifespan of a given phone ?
2) Maybe the number of non-free component in each phone requiring heavy retro-engineering ?
3) And why developing anything on a phone whereas user-friendly systems such as android already exist and have a wide community who probably wouldn't want to try another OS.
In our case, the n900 isn't anymore on the market, and at this state, neo900 is only vaporware.
Why would people outside of our community even consider beginning to hack anything for n900, in the case a phone they don't even heard about may (or may not) be released with a similar (but still different) hardware ?

That's why I propose to contact various developer teams to make them aware of the project, and send them prototypes if they are serious and interested, to make the project more concrete for them than "only vaporware". I don't know if it will lead to something, but I know not doing anything will not lead us anywhere.

RYF certification

I understand certain criteria of this certification could raise a debate in the community.
Actually, I'm not either 100% motivated by the "don't recommend non-Free software" clause (I consider myself more on the BSD-side of openness than GNU's). Anyway, the RYF certification exists and I don't see any phone more open than neo900. It would be sad if we don't even try to deal with it. About openness of baseband, telephony stack, etc., isn't the sandboxing of the modem (and the possibility to disable it) enough ?
Why not beginning a discussion about RYF certification and neo900 with FSF to put some light on what can or can't be allowed in the special case of a phone ?
Why not making two devices instead of one : The actual neo900 on one side, and the RYF-compliant neo900 on the other side, which would follow the rules discussed with FSF ?

Just what came to mind: learning from others?:
F.i. the Novena Laptop is also such a niche device, and they managed pretty good (using crowdsupply, roughly 1100 pledges). You could check on the Inet, how they created momentum - and you could even talk to them.
F.i. the Fairphone is such a niche device - and they did their own 'crowdfunding' (pre-orders).
Then there is the Librem laptop by Purism (crowdsupply, roughly 700 pledges). They also managed pretty good, although these devices obviously not that open as they advertised. Yet an example of well working PR, I guess.

How about contacting the KDE community to see if they would be interested in porting Plasma Mobile to the Neo900?

KDE recently presented their vision for the future which I think goes hand in hand with the aims of the Neo900 project, particularly the control, freedom and privacy parts.

With the possibility of Fremantle not being ready, it would be great if Plasma Mobile was running on top of the Debian that the Neo900 is expected to ship with. It's an opportunity for the Neo900 to be the flagship Plasma Mobile device. I think that both the Plasma Mobile and Neo900 communities could benefit a lot from the mutual exposure of both parties.

two little corrections though: we won't ship debian but a https://devuan.org/ which is barebones and only has factory test (cmdline) software to ensure the subsystems are working within parameters, and probably an installer wizard to help users to pick the community driven FOSS OS of their choice. Neo-fremantle looks rather promising already, SHR should work OOTB, and yes since this is a plain linux compliant ARM platform, basically almost all linux flavors that have a armel/armhf build should probably work instantly, with exception of a few subsystems like slider/kbd-backlight or camera that are unique to N(eo)900 and thus need some love to adapt them.

two little corrections though: we won't ship debian but a https://devuan.org/ which is barebones and only has factory test (cmdline) software to ensure the subsystems are working within parameters, and probably an installer wizard to help users to pick the community driven FOSS OS of their choice. Neo-fremantle looks rather promising already, SHR should work OOTB, and yes since this is a plain linux compliant ARM platform, basically almost all linux flavors that have a armel/armhf build should probably work instantly, with exception of a few subsystems like slider/kbd-backlight or camera that are unique to N(eo)900 and thus need some love to adapt them.

/jOERG

I'd gladly help with this, make contacts and even try building it myself for the N900, but not for a couple months. I'm extremely busy right now and probably shouldn't be spending my time on TMO. Hehe.

[OFFTOPIC]
I'm very pleased to hear that it will ship with Devuan. I fully support this choice. My experiments with running sane Linux include running plain Debian sid with System V init but also running Debian stretch (testing) with the Devuan ascii (testing) repositories enabled. Whilst they both work, both have some package compatibility issues with systemd-less installations but Devuan edges it. I guess Devuan are focussing on their stable release so hopefully things should improve. Another positive note is that it looks like there will be better support from Debian too.
[/OFFTOPIC]